Hi all again,

I'll be honest, the direction this thread went in;

http://www.webmaster-talk.com/php-fo...tml#post210062

has scared me to death! So a user could type SQL commands into a search-text box and they'd get appended to the resulting SQL query, potentially deleting your whole database!

would it be enough for me to just go through the string checking there are no semicolons?

check for SQL commands as well.

Limiting the length of input is also another way. For example, if you have a text field of 15 characters long in your database, truncate any input to 15 characters -before- it hits the database.

magic quotes, stripslashes are utils in php to prevent sql injections. ASP and .NET should have some similar utils too.

Use them thats what they are around for.

Ibbo

Limit the access right to the mysql user account would help.

I had a similar query the other week but nobody answered my post. What zenanthor wrote about permissions reminded me about it. Can someone please read this post and tell me what they think.

http://www.webmaster-talk.com/databa...tick-root.html

Thanks